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REMARKS 

Applicant appreciates the thorough examination of the present application as evidenced 
by the Final Office Action, including the Examiner's withdrawal of the objections to the figures. 
Applicant submits that the currently amended independent Claims 5-7, 9, 22, 23, and 31 are not 
anticipated by Aucsmith for at least the reasons explained below. Accordingly, Applicant 
requests reconsideration and allowance in view of the above amendments and the following 
remarks. 

Independent Claims 5 and 22 are Not Anticipated by Aucsmith: 

Claim 5 has been amended to independent fomi to recite, inter alia, that the method 
of responding to an intrusion includes selectively responding to a notification of an intrusion 
by a computer evaluating the notification based on a local IDS policy that includes 
information relating to whether the computer is protected by a firewall from a source of the 
intrusion . Claim 22 has also been amended to independent form and includes recitations 
corresponding to Claim 5. 

In rejecting Claims 5 and 22, the Final Office Action on page 4 now cites Aucsmith's 
paragraph 0065 which describes that the application monitor 308 may send information 
through the firewall 3 10 to the intrusion detection mechanism 312, and that the intrusion 
detection mechanism 312 can operate on that information to detect an intrusion. However, 
Aucsmith's description in paragraph 0065 assumes that the application monitor 380 is always 
protected by the firewall 310. Aucsmith does not describe or suggest that the application 
monitor 308 responds differently to an intrusion notification based on whether or not the 
firewall 3 10 is absent. Moreover, Applicant submits that neither the cited portion nor 
elsewhere does Aucsmith describe or suggest that application monitor 308 or another 
computer selectively responds to a notification of an intrusion by evaluating the notification 
based on whether or not the computer is protected by a firewall from a source of intmsion . 

Consequently, Applicant submits that Claims 5 and 22 are not anticipated by 
Aucsmith. Reconsideration and allowance of Claims 5 and 22 is requested. 
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Independent Claims 6^ 7^ 23^ and 31 are Not Anticipated by Aucsmith: 

Claim 6 has been amended to independent form to recite, inter alia^ that the method 
of responding to an intrusion includes selectively responding to a notification of an intrusion 
by a computer evaluating the notification based on a local IDS policy and memory 
utilization in the computer . In rejecting Claim 5, the Final Office Action on page 5 now 
cites Aucsmith's paragraph 0084 which describes that its techniques may be implemented in 
programs executing on programmable machines having volatile and non-volatile memory. 
However, neither paragraph 0084 nor elsewhere does Aucsmith describe or suggest that the 
agent 106, the application monitor 308 or another computer selectively responds to a 
notification of an intmsion by evaluating the notification based on a local IDS policy and 
memory utilization in the computer . Consequently, Applicant submits that Claim 6 is not 
anticipated by Aucsmith. Reconsideration and allowance of Claim 6 is requested. 

Claim 7 has been amended to independent form to recite, inter alia^ that the method 
of responding to an intrusion includes selectively responding to a notification of an intrusion 
by a computer evaluating the notification based on a local IDS policy and processor 
utilization in the computer . In rejecting Claim 7, the Final Office Action on page 8 again 
cites paragraph 0084 of Aucsmith. However, neither paragraph 0084 nor elsewhere does 
Aucsmith describe or suggest that the agent 106, the application monitor 308, or another 
computer selectively responds to a notification of an intrusion by evaluating the notification 
based on a local IDS policy and processor utilization in the computer . Consequently, 
Applicant submits that Claim 7 is not anticipated by Aucsmith. Reconsideration and 
allowance of Claim 7 is requested. 

Claims 23 and 3 1 have each been amended to independent form and include a 
combination of the recitations of Claims 6 and 7. For example. Claims 23 and 3 1 recite that 
the computer is configured to selectively respond to the notification based on a local IDS 
policy and based on at least one of memory utilization in the computer and processor 
utilization the computer . Accordingly, for at least the reasons explained above with regard 
to Claims 6 and 7, Applicant submits that Aucsmith does not anticipate Claims 23 and 3L 
Reconsideration and allowance of Claims 23 and 3 1 is requested. 
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Independent Claims 9 is Not Anticipated by Aucsmith: 

Claim 9 has been amended to independent form and recites that the computer 
selectively responds to the intrusion notification by evaluating the notification based on a 
local IDS policy and based on proximity of the computer to a source of the intrusion . In 
rejecting Claim 9, the Final Office Action on page 9 again cites to paragraphs 0028 and 0051- 
0055. Applicant submits that neither the cited paragraphs nor elsewhere does Aucsmith 
describe that the agent 106, the application monitor 308, or another computer determines 
proximity of itself to a source of the intmsion or, much less, that it selectively responds to an 
intrusion notification by evaluating the notification based on a local IDS policy and based on 
proximity of the computer to a source of the intrusion . Consequently, Applicant submits 
that Claim 9 is not anticipated by Aucsmith. Reconsideration and allowance of Claim 9 is 
requested. 

CONCLUSION 

In view of the above amendments and remarks, Applicant submits that the above- 
entitled application is in condition for allowance. Favorable reconsideration of this 
application is respectfully requested. If in the opinion of the Examiner, a telephonic 
conference would expedite the examination of this matter, the Examiner is invited to call the 
undersigned attorney at (919) 854-1400. 



RespectfiiUy svibmitted, 




David K. Purks ^ 
Registration No. 40,133 
Attorney for Applicant(s) 
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